Failure detection and seamless traffic switchover using a VPN system

Abstract

Example implementation relates to a method of failure detection and seamless traffic switchover in a VPN system. A cluster of nodes exchange heartbeat messages to detect a failure at a first node in the cluster. When failure is detected at the first node, a master node transmits a failover message to a network end node connected to the first node. The failover message includes a list of active nodes to which traffic may be routed. The network end node updates its routing table based on the failover message and switches the traffic to a second node in the cluster of nodes.

What is claimed is: 
     
       1. A virtual private network (VPN) system comprising:
 a plurality of network end nodes connected to a cluster of nodes; 
 a processor associated with a master node of the cluster of nodes; 
 a first machine-readable medium storing instructions that, when executed by the processor of the master node, causes the processor to:
 exchange heartbeat messages between the nodes in the cluster to detect a failure of a node in the cluster of nodes; and 
 in response to detecting the failure of a first node in the cluster of nodes, transmit a failover message to a network end node connected to the first node, wherein the failover message comprises of a list of active nodes in the cluster of nodes; 
 
 wherein the network end node comprises a network end node processor and a second machine-readable medium storing instructions that, when executed by the network end node processor, causes the network end node processor to:
 receive the failover message from the master node of the cluster of nodes; 
 update a route table of the network end node based on the failover message; and 
 switch route of traffic to a second node in the cluster of nodes based on the updated route table. 
 
 
     
     
       2. The method of  claim 1 , wherein the cluster of nodes forward VPN traffic received from the plurality of network end nodes to a data center. 
     
     
       3. The VPN system of  claim 1 , wherein the cluster of nodes comprises of a cluster of VPN Concentrators (VPNCs). 
     
     
       4. The VPN system of  claim 1 , wherein each of the plurality of network end nodes comprises of a wireless access point (AP) or a gateway. 
     
     
       5. The VPN system of  claim 1 , wherein the master node communicates messages from the cluster of nodes to the network end node. 
     
     
       6. The VPN system of  claim 1 , wherein connection between the first node and the network end node is one of: an Internet Protocol Security (IPsec) connection or a Secure Sockets Layer (SSL) connection. 
     
     
       7. A method for seamless failover in a VPN system, the method comprising:
 exchanging heartbeat messages between the nodes in a cluster of nodes to detect a failure of a node in the cluster of nodes, wherein the cluster of nodes is connected to a plurality of network end nodes; 
 in response to detecting the failure of a first node in the cluster of nodes, transmitting by a master node in the cluster of nodes a failover message to a network end node connected to the first node, 
 wherein the failover message comprises of a list of active nodes in the cluster of nodes; 
 receiving, at the network end node, the failover message from the master node of the cluster of nodes; 
 updating, a route table of the network end node based on the failover message; and 
 switching route of traffic to a second node in the cluster of nodes based on the updated route table. 
 
     
     
       8. The method of  claim 7 , wherein detecting a failure of the first node comprises of:
 determining the failure of the first node in the cluster of nodes when a pre-defined number of heartbeat messages are not received from the first node by the other nodes in the cluster of nodes. 
 
     
     
       9. The method of  claim 7 , wherein the master node communicates messages from the cluster of nodes to a plurality of network end nodes. 
     
     
       10. The method of  claim 7 , wherein the cluster of nodes forward traffic received from a plurality of connected network end nodes to a data center. 
     
     
       11. The method of  claim 7 , wherein updating the route table of the network end node comprises deactivating a route towards the first node in the route tabling. 
     
     
       12. The method of  claim 7 , wherein the cluster of nodes comprises of a cluster of VPNCs. 
     
     
       13. The method of  claim 7 , wherein each of the plurality of network end nodes comprises of a wireless access point (AP) or a gateway. 
     
     
       14. The method of  claim 7 , wherein the connection between the first node and the network end node is one of: an Internet Protocol Security (IPsec) connection or a Secure Sockets Layer (SSL) connection. 
     
     
       15. A first non-transitory machine-readable storage medium comprising first instructions and a second non-transitory machine-readable storage medium comprising second instructions, the first instructions executable by a first processor to:
 exchange heartbeat messages between the nodes in a cluster of nodes to detect a failure of a node in the cluster of nodes; and 
 in response to detecting the failure of a first node, transmit a failover message to a network end node connected to the first node, wherein the failover message comprises of a list of active nodes in the cluster of nodes; and 
 the second instructions executable by a second processor to:
 receive the failover message from the master node of the cluster of nodes; 
 update a route table of the network end node based on the failover message; and 
 switch route of traffic to a second node in the cluster of nodes based on the updated route table. 
 
 
     
     
       16. The first and second non-transitory machine-readable storage mediums of  claim 15 , wherein the cluster of nodes comprises of a plurality of VPN Concentrators (VPNCs). 
     
     
       17. The first and second non-transitory machine-readable storage mediums of  claim 15 , wherein the network end node comprises of a wireless access point (AP) or a gateway. 
     
     
       18. The first and second non-transitory machine-readable storage mediums of  claim 15 , wherein the failover message is sent to the network end node from a master node of the cluster of nodes, and wherein the master node communicates messages from the cluster of nodes to the network end node.